Bug 1413137 (CVE-2017-2590)

Summary: CVE-2017-2590 ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dkholia, ftweedal, jcholast, ksiddiqu, nsoman, pvoborni, rcritten, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ipa 4.4 Doc Type: If docs needed, set a value
Doc Text:
It was found that IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-09 18:47:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1414653, 1414703, 1427094    
Bug Blocks: 1413140    

Description Andrej Nemec 2017-01-13 17:37:22 UTC
Multiple security issues were found in FreeIPA's 'ca' plugin. Any authenticated but unauthorised user can delete, disable or enable CAs in Dogtag. The impact in the deletion case is denial of service for cert issuance or OCSP signing, and deletion of secret keys. The impact for disablement is denial of service for cert issuance.

Comment 1 Andrej Nemec 2017-01-13 17:37:28 UTC
Acknowledgments:

Name: Fraser Tweedale (Red Hat)

Comment 15 Dhiru Kholia 2017-02-27 11:02:28 UTC
Created freeipa tracking bugs for this issue:

Affects: fedora-all [bug 1427094]

Comment 18 errata-xmlrpc 2017-03-02 17:25:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0388 https://rhn.redhat.com/errata/RHSA-2017-0388.html